// tag

FreePBX

Security incidents tagged FreePBX. Newest first.

## 1 FreePBX incident in the last 12 months

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

show 2 older incidents

Feb 3highSangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerabilitypatched
› Sangoma FreePBX patched
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03.
open incident →CVE-2025-64328

Aug 29criticalSangoma FreePBX: FreePBX Authentication Bypass Vulnerabilitypatched
› Sangoma FreePBX patched
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.
open incident →CVE-2025-57819